October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-92885 The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-18450 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
critical | 9.8 | — | — | 2026-10-27 | 2026-11-04 |
| CVE-2026-116508 A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-84633 A path traversal issue was addressed with improved path validation. |
critical | 9.0 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-84539 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-116506 A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116504 A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116505 A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-113897 This issue was addressed by removing the vulnerable code. |
critical | 10.0 | — | Apple / safari | 2026-10-26 | 2026-11-03 |
| CVE-2026-112690 This issue was addressed with improved input validation. |
critical | 10.0 | — | Apple / ipados | 2026-10-26 | 2026-11-03 |
| CVE-2026-112552 An out-of-bounds write issue was addressed with improved bounds checking. |
critical | 9.8 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-112521 A buffer overflow was addressed with improved bounds checking. |
critical | 9.3 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-112526 A buffer overflow was addressed with improved bounds checking. |
critical | 9.8 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-112514 A use-after-free issue was addressed with improved memory management. |
critical | 9.1 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-112497 This issue was addressed with improved permissions checking. |
critical | 9.0 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-112478 An out-of-bounds read issue was addressed by removing the vulnerable code. |
critical | 9.0 | — | Apple / macos | 2026-10-26 | 2026-11-04 |
| CVE-2026-112443 The issue was addressed with improved memory handling. |
critical | 9.1 | — | — | 2026-10-26 | 2026-11-03 |
| CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authori... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115915 vLLM is an inference and serving engine for large language models. |
critical | 9.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-10757 There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and e... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-102649 Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes oper... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116370 A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.... |
critical | 9.6 | — | 2k / sid meiers civilization vi | 2026-10-26 | 2026-11-02 |
| CVE-2026-112346 OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote co... |
critical | 9.8 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-65184 The root-privileged `wsserver` terminal-bridge daemon builds a shell command fro... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-31158 SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 a... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-59106 A security vulnerability has been identified in the WolfProt interface implement... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-59107 A security vulnerability has been identified in the vSolution Matrix file sharin... |
critical | 9.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116485 danmu_api before 1.21.7 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-116214 MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability... |
critical | 9.1 | — | — | 2026-10-26 | 2026-11-04 |
| CVE-2026-115188 An unrestricted file upload vulnerability exists in the campaign import feature... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.